OpenMedia

Privacy Plan

Recommendation 2: End Mass Surveillance

RECOMMENDATION 2: END MASS SURVEILLANCE

What Canadians Want:

 

Participants in our crowdsourcing survey expressed deep concern about mass surveillance – they want to see an end to the practice. Key findings from our crowdsourcing process include:

  • 93.8% said CSE, CSIS, and other government agencies should only be able to obtain Canadians’ sensitive personal information when a judge grants a warrant to conduct surveillance against a specific target.
  • When we presented crowdsourcing participants with six key privacy priorities, “End blanket surveillance of law-abiding people” came second only to “Require a warrant”. Fully 60.8% of participants chose ending blanket surveillance as one of their top three priorities.
  • 89.1% want to see all surveillance activities require a warrant approved by a judge.
  • 92.2% said CSIS and the RCMP should be forbidden from using public resources to monitor peaceful individuals, organizations, and groups not posing any known threat to national security. Only 2.3% believed this was appropriate.
  • Mass surveillance, including the bulk collection of deeply revealing metadata, is by definition conducted without a warrant. Canadians overwhelmingly believe the government should obtain a warrant before spying on personal information. 68.9% listed this among  their top three privacy priorities, with 22.7% choosing it as their top priority.

Once again, these findings are reinforced by independent surveys. The federal Privacy Commissioner’s 2014 Survey of Canadians found that 77% were “very concerned” about law enforcement and security agencies collecting their personal information for surveillance purposes.120 A Forum Research poll also found that just 8% of Canadians trusted the CSE with their personal information, with only 23% trusting CSIS, and 37% trusting the RCMP.121

These results are unsurprising, given what has been revealed about Canadian spy agency activities, and those of their Five Eyes partners, over the past couple of years. Thanks to Edward Snowden, people are increasingly aware that surveillance is being conducted on a massive scale, and that it takes no suspicion of wrongdoing to find oneself under the government’s microscope. The Privacy Commissioner’s recent survey found that roughly half of all Canadians had seen, read, or heard something about the surveillance revelations in the past year.122

As outlined earlier in this report, a number of specific revelations would have laid to rest any notion that Canadians were immune to mass surveillance. People learned that, for example, the CSE spied on thousands of innocent Canadian air travellers.123 And that under the CSE’s LEVITATION program, just clicking a link could get you caught in the government’s surveillance dragnet.124

Our findings and dozens of independent reports confirm that Canadians have a right to be concerned. Mass surveillance contributes to our privacy deficit and weakens our democracy in a number of important ways.

Undermining human rights

 

A wide range of human rights organizations, international institutions, and privacy experts have spoken out about how mass surveillance activities, especially the bulk collection of metadata, undermine citizens’ fundamental human rights:

  • Former Ontario privacy commissioner Ann Cavoukian has warned about how metadata can be used to paint a deeply revealing portrait of any individual’s private life. The Ontario Information & Privacy Commissioner’s 2013 report A Primer on Metadata: Separating Fact from Fiction explains how metadata, when collected in bulk, can be even more revealing than the actual content of private communications:  

“Metadata surveillance programs gather and analyze private sector metadata involving the activities of the public. In so doing, they facilitate the state’s power to instantaneously create a detailed digital profile of the life of anyone swept up in such a massive data seizure. Once this data is compiled, detailed pictures of the lives of individuals begin to emerge that may easily be linked to places and events.”125

  • Here in Canada, the CSE’s mass surveillance practices are the subject of an ongoing constitutional challenge from the British Columbia Civil Liberties Association (BCCLA). Stating that “secret and unrestrained government surveillance presents a grave threat to democratic freedoms”, the BCCLA challenged the bulk collection of metadata on the grounds that:

“The collection of metadata is digital surveillance. CSEC spies on Canadians by collecting information every time an email or text message is sent, every time a phone call is made, every time the internet is accessed. CSEC can collect, retain and analyze this personal information to create a picture of a Canadian and his or her relationships with other Canadians… This kind of widespread surveillance without accountability is fundamentally incompatible with Canadian democracy.”126

  • Malte Spitz, a German politician and privacy advocate, obtained six months of his mobile phone data from his wireless provider. He provided this to Die Zeit which, combining it with data from other publicly available sources, used it to create a detailed narrative of Mr Spitz’s activities over the six month period. The resulting animated map revealed Mr Spitz’s travels, activities, political speeches, time spent on the phone, and time spent online. Die Zeit concluded that:

“This profile reveals when Spitz walked down the street, when he took a train, when he was in an airplane. It shows where he was in the cities he visited. It shows when he worked and when he slept, when he could be reached by phone and when was unavailable. It shows when he preferred to talk on his phone and when he preferred to send a text message. It shows which beer gardens he liked to visit in his free time. All in all, it reveals an entire life.”127

This is significant because it underlines that metadata can paint an incredibly detailed picture of someone’s private life not just in the present day, but going back months or even years, depending on how long the metadata is retained for.

  • Concerns about how the bulk collection of metadata can undermine human rights are shared in other jurisdictions. For example, the parliamentary assembly of the Council of Europe’s Legal Affairs Committee stated in a January 2015 report that mass surveillance, including the bulk collection of metadata, threatens basic human rights. The report also ruled that the U.K. GCHQ’s mass surveillance activities contravened article 6 (right to a fair trial), article 8 (right to privacy), and article 10 (right to free expression) of the European Convention on Human Rights. The report concludes that:

“The ‘Snowden files’ have shown the extent of the threat mass surveillance represents for our privacy and other human rights whose effective exercise depends on privacy - such as freedom of expression and information, even freedom of religion, the right to a fair trial and the right to equal treatment.”128

Internet Voice: “Part of the deal in being a citizen of a free society is the expectation that our personal affairs and physical person are inviolable as long as we remain within the law.” - Anne-Marie S.

Ministers doing an end-run around judicial safeguards

 

In November 2011, then Defence Minister Peter MacKay issued a ministerial directive to authorize CSE to spy on Canadians without a warrant.129 The program authorized by Minister MacKay involved the bulk collection of metadata from individuals around the globe, including Canadians. According to government documents revealed by The Globe and Mail, the program had previously been suspended due to concerns it could lead to warrantless surveillance of Canadians.130

This concern was and is understandable— bulk collection of metadata by definition circumvents the entire system of warrant protections. This practice is also the subject of a constitutional challenge, mentioned above, from the B.C. Civil Liberties Association,131 supported by OpenMedia and a range of other pro-privacy organizations.132

The government and the CSE justify the bulk collection of metadata by claiming that metadata does not fit within their definition of “private communications”. However, as we’ve seen, metadata can in fact be used paint a vivid picture of a target’s personal life, past and present.   For this reason, Canadians deserve robust safeguards to put an end to the government’s interception and collection of metadata.

Steps to Implementation:

 

Participants in our crowdsourcing project expressed clear concern about mass surveillance activity in Canada. We know that Canadians want to put an end to the widespread collection of their private data, and so we worked with experts to outline what that might look like in practice. This is not intended as an exhaustive list, but rather as an overview of what will need to be done to put a stop to surveillance abuses and better protect the privacy of Canadians. Here are the key components:

 

1. End all suspicion-less mass surveillance, including the bulk collection of metadata:

Any government surveillance is inherently invasive. For this reason, surveillance should only be conducted in a targeted manner, and only under a court order or warrant. Canadian intelligence agencies should cease all suspicionless surveillance activities that are directed against the general public, whether here in Canada or overseas.

The government should conduct an audit of all of CSIS and CSE’s ongoing surveillance programs, and halt any that involve the warrantless collection of Canadians’ personal information, including metadata, from the public. The secret Ministerial Authorizations issued by Peter MacKay in 2011133 to spy on metadata should be made public and revoked. As proposed by Joyce Murray’s Bill C-622, new legislation should recognize the privacy value of metadata by defining it as protected information, thereby putting a stop to the bulk collection of metadata from the public.

These measures are necessary to stop and prevent any repetition of Canadian mass surveillance programs such as LEVITATION,134 EONBLUE,135 or the CSIS monitoring of members of peaceful advocacy groups.136 All future surveillance activities should be targeted and specific, rather than indiscriminate.  

 

2. Require judicial not political authorization for surveillance:

In any democracy, citizens need to know how a law is being applied, in order to have an informed debate about whether that law needs changing. In Canada, the government has often reassured Canadians that surveillance activities are lawful, while keeping secret how “lawful” is interpreted. Much of CSE’s spying activities are approved by secret ministerial authorizations, such as those issued by Peter MacKay in 2011.

All intrusive surveillance activities should be authorized by a serving judge, where possible in an open court, instead of by a government minister. This would ensure that any such activities are consistent with the rule of law, and directed against specific targets instead of whole populations. New legislation governing surveillance powers should therefore take away the power of the Minister of National Defence to secretly authorize surveillance activities. Instead, as proposed by Joyce Murray’s 2014 CSEC Accountability and Transparency Act,137 this power should instead be vested in an independent judge of the Federal Court.

 

3. No future expansion of surveillance without a verifiable need:

Canadians deserve a clear government commitment to abstain from expanding surveillance, access to citizen data, or transmission of citizen data to other governments or agencies unless there is a clear, publicly accounted-for need that is demonstrated by verifiable evidence. Any expansions of information sharing or surveillance should be debated publicly, be clearly proportionate to the government’s stated needs, be demonstrably effective in meeting those needs, and should expand data collection to the smallest degree necessary to meet those needs.

 

4. Prevent government agencies monitoring what Canadians say on social media:

In November 2014 it was revealed that the government was creating a new system for collecting and analyzing what Canadians are saying on Facebook and other social media services. 138 The system would offer “real-time monitoring and analysis of social media content including Twitter, Facebook, blogs, chatrooms, message boards, social networks and video and image sharing websites”. The move flew in the face of warnings published earlier in the year from the then federal Privacy Commissioner Chantal Bernier about government institutions collecting information from Canadians’ social networking profiles in violation of the Privacy Act.139

When Canadians post on Facebook they believe they’re sharing with family and friends, not with a government bureaucrat in Ottawa. Long-standing confusion around Facebook’s privacy settings, however, means that often these messages are made publicly available, as opposed to just being visible to friends. The government’s new social media monitoring system appears to take advantage of this in order to systematically collect these often deeply personal communications.

Internet Voice: “There are places where you should not feel threatened. For example, if you are on Facebook you shouldn’t be scared that something you say or post will have negative impacts against you. - Alex S., high school student

Nor is this issue restricted to social media monitoring from the federal government. Toronto police chief Bill Blair has boasted about how his force used the geofencing capability of the device of a protester who was active on social media to track the precise locations of people attending a local protest.140

This type of pervasive monitoring, collection, and analysis of Canadians’ online communications and social media profiles is incompatible with democratic values. It is also arguably illegal under the Privacy Act, but the fact that it is happening anyways suggests the law needs to be strengthened.

Clear limits must be set around the government’s collection and use of information on Canadians, even when such information is publicly available online. Where there is a legitimate reason for the targeted collection of such information, it is imperative that the targeted collection of such information be conducted transparently, used strictly for the purpose for which it was collected, and that all such information is disposed of when no longer required for a legitimate purpose.

Footnotes: 

[120] Office of the Privacy Commissioner: 2014 Survey of Canadians on Privacy. Source: https://www.priv.gc.ca/information/por-rop/2015/por_2014_12_e.asp#fig24

[121] Forum Research: Three-quarters disapprove of Bill C-13. Source: http://poll.forumresearch.com/post/68/three-quarters-disapprove-bill-c13/

[122] Ibid.

[123] CBC News: CSEC used airport Wi-Fi to track Canadian travellers. Source: http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-track-canadian-travellers-edward-snowden-documents-1.2517881

[124] The Intercept: Canada casts global surveillance dragnet over file downloads. Source: https://firstlook.org/theintercept/2015/01/28/canada-cse-levitation-mass-surveillance/

[125] Office of the Ontario Information & Privacy Commissioner: A Primer on Metadata, Separating Fact from Fiction. Source: https://www.privacybydesign.ca/index.php/paper/a-primer-on-metadata-separating-fact-from-fiction/

[126] B.C. Civil Liberties Association: Backgrounder on Spying in Canada. Source: https://bccla.org/stop-illegal-spying/protect-our-privacy-case-details/

[127] Die Zeit: Betrayed by our own data. Source: http://www.zeit.de/digital/datenschutz/2011-03/data-protection-malte-spitz

[128] Parliamentary Assembly of the Council of Europe: Committee on Legal Affairs and Human Rights Mass Surveillance Report. Source: http://www.scribd.com/doc/253848295/Mass-Surveillance-Report

[129] Toronto Star: Peter MacKay spelled out when eavesdropping agency should help CSIS, RCMP, records show. Source: http://www.thestar.com/news/canada/2013/06/13/peter_mackay_spelled_out_when_eavesdropping_agency_should_help_csis_rcmp_records_show.html

[130] The Globe and Mail: Data-collection program got green light from MacKay in 2011. Source: http://www.theglobeandmail.com/news/politics/data-collection-program-got-green-light-from-mackay-in-2011/article12444909/

[131] BC Civil Liberties Association: Stop illegal spying. Source: https://bccla.org/stop-illegal-spying/

[132] For a full list of partner organizations, see https://OpenMedia.ca/CSEC

[133] The Globe and Mail: Data-collection program got green light from MacKay in 2011. Source: http://www.theglobeandmail.com/news/politics/data-collection-program-got-green-light-from-mackay-in-2011/article12444909/

[134] The Intercept: Canada casts global surveillance dragnet over file downloads. Source: https://firstlook.org/theintercept/2015/01/28/canada-cse-levitation-mass-surveillance/

[135] Motherboard: How Canadian spies infiltrated the Internet’s core to watch what you do online. Source: http://motherboard.vice.com/read/how-canadian-spies-infiltrated-the-internets-core-to-watch-what-you-do-online

[136] Vancouver Observer: Harper government’s extensive spying on anti-oilsands groups revealed in FOIs. Source: http://www.vancouverobserver.com/politics/harper-governments-extensive-spying-anti-oilsands-groups-revealed-fois

[137] This bill was voted down by the government, which refused to let it even be studied by a Parliamentary committee.

[138] Motherboard: The Canadian government wants to pay more people to creep your Facebook. Source: http://motherboard.vice.com/read/the-canadian-government-wants-to-pay-more-people-to-creep-your-facebook   

[139] Motherboard: The Canadian government is creeping on your Facebook. Source: http://motherboard.vice.com/read/the-canadian-government-is-creeping-on-your-facebook

[140] Vice: Toronto police chief bragged about monitoring protesters. Source: http://www.vice.com/en_ca/read/watch-torontos-police-chief-brag-about-spying-on-political-protesters-263